April 14, 2021

Volume XI, Number 104

Advertisement

April 13, 2021

Subscribe to Latest Legal News and Analysis

April 12, 2021

Subscribe to Latest Legal News and Analysis

California DOJ Announces a Third Set of Modifications to the CCPA Regulations

Back in August, after much anticipation and several rounds of review and modification, the California Consumer Privacy Act (CCPA) regulations finally became effective. This was long awaited by businesses and their service providers looking for compliance guidance and clarity on key issues related to facilitation of consumer rights.  This week, the California Department of Justice (“DOJ”) announced there would now be a third set of proposed modifications made to the CCPA regulations.

As a quick recap of past of developments related to the CCPA regulations, the DOJ first published CCPA proposed regulations on October 11, 2019.  In February 2020 and again in March, the DOJ gave notice of modifications to the proposed regulations, based on comments received during the relevant public commentary periods.  The final version of the CCPA regulations that became effective in August, was substantively unchanged from the previous version from March.

Below are highlights from the third set of proposed modifications made to the CCPA regulations, released this week:

  • Addition of examples of how businesses that collect personal information in the course of interacting with consumers offline can provide the notice of right to opt-out of the sale of personal information through an offline method.
  • Guidance on how a business’s methods for submitting requests to opt-out should be easy and require minimal steps. It provides illustrative examples of methods designed with the purpose or substantial effect of subverting or impairing a consumer’s choice to opt-out.
  • Clarification on the proof that a business may require an authorized agent to provide, as well as what the business may require a consumer to do to verify their request.
  • Clarification that businesses that have actual knowledge that they sell PI of minors are required to include in their privacy policies a description of their method for verifying that the person authorizing the sale of a child’s data is actually that child’s parent or guardian.

The DOJ’s notice regarding the proposed modifications and a comparative version of the new text are available here.  The DOJ will accept written comments from the public regarding the proposed modifications between Tuesday, October 13, 2020 and Wednesday, October 28, 2020. Written comments may be submitted to the DOJ via email to PrivacyRegulations@doj.ca.gov.

Since the CCPA’s effective date back in January there have been an influx of developments, as the legislature and regulators help to clarify ambiguities and provide greater specificity on key compliance issues facing covered businesses and their service providers. Just last week we reported on CCPA amendment, AB 1281, which extended exemptions for “B2B” and employee personal information. We will continue to update on CCPA and other related developments as they unfold.

Advertisement
Jackson Lewis P.C. © 2021National Law Review, Volume X, Number 287
Advertisement
Advertisement

TRENDING LEGAL ANALYSIS

Advertisement
Advertisement

About this Author

Principal

Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm's Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and...

973- 538-6890
Jason C. Gavejian, Employment Attorney, Jackson Lewis, Principal, Restrictive Covenants Lawyer
Principal

Jason C. Gavejian is a Principal in the Morristown, New Jersey, office of Jackson Lewis P.C. and a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy Professionals.

Mr. Gavejian represents management exclusively in all aspects of employment litigation, including restrictive covenants, class-actions, harassment, retaliation, discrimination and wage and hour claims in both federal and state courts. Additionally, Mr. Gavejian regularly appears before administrative agencies,...

(973) 538-6890
Attorney

Maya Atrakchi is the Knowledge Management (“KM”) Attorney for Jackson Lewis P.C.’s Privacy, e-Communication and Data Security and International Employment Issues Practice Groups, and is based in the New York City, New York, office of Jackson Lewis P.C.

212-545-4000
Advertisement
Advertisement